Evidence note: this article rests on project self-descriptions — README files, landing pages, and launch posts written by the people shipping these tools — plus one set of figures produced by PlayAgit’s own publishing pipeline and recorded in its run ledger. None of the third-party claims below have been independently reproduced or audited here: where a project states a number, the verified fact is that the project stated it, and that distinction is carried through every section rather than repeated in each one. Specific figures are marked at the point they appear.
A wave of launches built for the hours nobody is at the keyboard
Within a short span, a cluster of projects shipped with the same pitch: the agent keeps working when you close the laptop. Rampart is a policy gate for agent tool calls. LiberClaw puts each agent on its own virtual machine. Computer Agents gives each agent an isolated cloud computer. Dorabot wraps an existing coding agent in a macOS harness. v16 runs small persistent processes on a laptop. Co-Op hosts background agents for people who do not want to leave a Mac Mini on. Screenpipe records the desktop continuously and serves it back as a memory API.
Most of these arrived as launch posts on Hacker News rather than as products with third-party reviews behind them (one such thread; another). Their descriptions are the authors’ own. Several are plausible on their face and none has been independently confirmed for this piece.
Four design choices the unattended platforms all made
Read across the self-descriptions and the same four decisions recur.
Persistent workspaces. Computer Agents describes a workspace whose files, code, and memory survive between runs; LiberClaw describes each agent holding its own filesystem and database; Dorabot’s project page describes the agent keeping memory, research notes, and daily journals. All three are the projects’ own claims and remain unverified independently.
Scheduled wake-ups instead of prompts. The trigger is a clock, not a human. Dorabot’s documentation describes heartbeat pulses that wake the agent on a schedule to scan for what needs doing, propose tasks, and execute after approval. Computer Agents states that runs are triggered by cron, webhooks, or a "keep working until done" mode. v16 is described by its author as running cron jobs for git checks, research, and monitoring.
Chat apps as the out-of-band control channel. With no terminal in front of the operator, the status line moves to a messenger. v16 is described as controlled through Telegram handles such as @devops, @research, and @monitor; Dorabot’s page lists WhatsApp, Telegram, and Slack; Computer Agents states results are delivered by email or Telegram; agentic-scheduling books meetings over WhatsApp, Slack, or the web, according to its repository.
One VM or container per agent. Isolation is the default containment story across LiberClaw and Computer Agents alike — each agent gets its own machine so a bad run damages one sandbox. None of these isolation claims has been tested here.
Where Rampart came from: an agent that could not be stopped mid-command
Rampart’s own project page gives an origin story worth reading next to the four design choices above. Its author states they ran an AI agent around the clock and unsupervised on a home lab — managing a k3s cluster, running shell commands, editing configuration — and had no way to stop a bad command before it executed. That is the gap the persistent-workspace and one-VM-per-agent designs do not close: isolation limits blast radius after the fact; it does not intercept the command.
The account is the author’s own and has not been independently corroborated. What it usefully names is a failure mode the rest of the wave leaves implicit.
What a policy gate and a hash-chained audit trail actually record
According to Rampart’s own documentation, the tool evaluates every agent tool call against a YAML policy before it runs, blocking denied commands — rm -rf / and cat ~/.ssh/id_rsa are the stated examples. Every evaluated action, denials included, is written to a hash-chained audit trail, readable live with rampart watch or rendered as HTML with rampart report. Integration with Claude Code is described as a single rampart setup claude-code step that installs hooks intercepting each Bash command, file read, and file write before execution.
Two properties in that description matter more than the blocklist. First, the log records evaluated calls, not just executed ones — a denial is an entry, so the record answers "what did the agent try" and not only "what did it do." Second, hash-chaining means a tampered entry is detectable. Independent verification of these behaviours is open; the claims come from the project itself and have not been exercised here. The broader tooling landscape around this pattern is covered in a companion piece on policy gates, hash-chained audit trails, and the unattended agents that made them necessary.
The numbers the projects themselves publish
Four figures circulate in this wave, and they are not the same kind of claim.
- 61 agents across 578 conversations at 99.7% uptime — LiberClaw’s own reported figures, unverified independently. The project also states inference runs on open models (Qwen3 Coder, GLM-4.7), removing the need for OpenAI or Anthropic API keys.
- A 70% success rate — VebGen’s stated figure for an autonomous Django development agent that plans architecture, writes code, reviews for issues such as OWASP Top 10 and N+1 queries, and fixes bugs. The project describes itself as roughly a 500KB codebase built over eight months on free-tier models, with auto-save and rollback. Self-reported; the success criterion is not published alongside the rate.
- 100-plus listed agents — the size claimed for Metaschool’s open-source agent marketplace, where builders can list agents free of charge. Unverified.
- 25-plus companies onboarded, with agents improving at 64% efficiency per month — Maven AI Agents’ own claims, unverified, alongside the team’s assertion that businesses spend over $500B annually on outsourcing repetitive work.
Implementation Note
PlayAgit’s publishing pipeline is itself an unattended agent system, and its ledger holds the kind of record the section above is asking third parties for. For the twenty days from 28 August to 16 September 2026, PlayAgit’s own pipeline runs (n=89 runs, 2026-08-28–2026-09-16, as of 2026-09-16) recorded the following.
The quality gate reviewed 634 drafts in that window: 480 published, 116 sent back to revise, and 38 rejected — a published share of roughly 76%, derived by dividing 480 by 634. Over the same 89 runs, 527 posts were published, of which 220 were new and 118 were updates to existing posts.
The verification side is the more revealing column. Across 3,142 research dossiers holding 11,968 individual claims, those same runs recorded 531 claims as independently cross-checked and 2,100 as primary-attested — meaning roughly 4.4% of claims cleared independent corroboration and about 18% were attested by the subject’s own official source (both percentages derived from the counts above). Every third-party number in the previous section of this article falls in the unverified remainder.
Upstream of that, the same runs (n=89, 2026-08-28–2026-09-16) scored 23,992 topics: 11,100 rejected, 9,085 held before production, and 3,807 sent to production. Candidate discovery for that pool covered 20,677 topic candidates across four categories drawn from 213 distinct source hosts.
These are PlayAgit’s own measurements of its own pipeline. They are not an independent audit of anything, and they describe a publishing system, not a coding agent — the comparison is in the shape of the record, not in the workload.
Why uptime and a success rate are checkable and a monthly improvement rate is not
Sort the four published figures by what a skeptical reader would have to obtain to check them.
99.7% uptime has a countable event behind it: a health check that either succeeded or failed at a given timestamp. Verification needs the probe interval, the definition of "up," and the raw series. The number is falsifiable in principle even if the data is not public.
A 70% success rate also has a countable event behind it — a task attempt that either passed or failed — but the definition does the work. Success at "fixes bugs autonomously" could mean tests pass, a human accepted the diff, or the agent reported completion. A prior look at agent run records found precisely this gap between an agent reporting success and the record showing nothing happened. The figure is verifiable once the pass criterion and the task set are published; until then it is a self-report with an undefined denominator.
64% efficiency improvement per month has no such event. "Efficiency" is not defined, no baseline is given, and a compounding monthly rate implies a measurement repeated on a stable task set — which would have to be named for the claim to mean anything. It is not a number that can be wrong; it is a number that cannot be checked. The $500B outsourcing figure is a different species again: a market-size claim attributed to the vendor whose product addresses that market, with no source given.
The practical test: ask what single event, timestamped, would have to have happened for the number to be true. Uptime passes. Success rate passes once the criterion is stated. A monthly self-improvement rate does not.
Re-reading the rest of the field with that distinction in hand
Applied across the wave, the distinction sorts quickly.
The marketplace and directory listings are population counts — Metaschool’s 100-plus agents is checkable simply by counting the listing, though the count says nothing about whether the agents work.
The "digital teammate" listings are positioning, not measurement. An agent marketed as a 24/7 digital teammate that discovers freelance opportunities and automates workflows, an AI freelancer agent on Seedster, an M&A due diligence team, a 24/7 digital educator for exam papers, a midnight worker for factory operation, a personal autonomous agent, an open agentic runtime for running whole businesses, and an all-scenario agent that gets work done all describe scope rather than results. Each is its project’s own description; none carries a figure to check.
The outsourcing framing sits at the far end. A claim that agents will displace finance, HR, support, and data-entry teams rests on the unverifiable improvement rate, not on the checkable uptime number — the strong claim is supported by the weak evidence. The same pattern shows up in the broader prediction that billions of agents will eventually run around the clock, a forecast attributed to investor Vinod Khosla and not independently confirmed here.
Two entries deserve a narrower read. A collection of 24 model-agnostic agent skills covering security, deployments, databases, payments, testing, and AI engineering is a count of files, which is trivially checkable and genuinely useful. And an operator running a complete blogging pipeline through an always-on agent — writing, image generation, git branch and merge, deploy triggers, Telegram notifications — attributes its effectiveness to full SSH access and no sandbox restrictions. That account, unverified, is the direct opposite of Rampart’s thesis, and the disagreement between them is the most useful unresolved question in the wave. Neither side has published a comparable incident record.
Developer takeaway: one number to demand, one comparison still missing
Before leaving any agent running unattended, ask for one thing: the denied-action log. Not uptime, not a success rate — the count of actions the agent attempted and the gate refused, with timestamps.
That single number does what the others cannot. It is a countable event. It reveals whether a gate exists at all — a platform with no denial log has no interception layer, only isolation after the fact. It shows what the agent reaches for when nobody is watching, which is exactly the information the unattended case removes from view. And unlike a success rate, it does not depend on anyone agreeing what success means.
A vendor that cannot produce it is offering containment, not control. A vendor that can has, by construction, the record needed to check its other claims.
The comparison not yet run here is the obvious one: put an identical task set through a gated agent and an ungated one on the same workload, and measure both the denial count and the completion rate. That would test the disagreement between the policy-gate position and the full-access position with evidence rather than anecdote. It is a proposed follow-up, not a result — no such run exists in the record.
How this is applied in Vision
The pipeline record above is what the takeaway looks like when it is applied to itself. PlayAgit’s own runs (n=89 runs, 2026-08-28–2026-09-16) log the gate’s refusals as first-class entries, not exceptions: 116 drafts sent back and 38 rejected against 480 published, and 11,100 topics rejected and 9,085 held against 3,807 sent to production. The rejections are the evidence that the gate ran.
The same rule governs this article. Of the 11,968 claims in the research record for that window, 531 were independently cross-checked; every third-party figure above sits outside that set and is marked accordingly. An unattended pipeline that publishes only its successes has no audit trail — which is the reason to ask an unattended agent for its denials first.